A microcode update does not require a BIOS update. In fact the first MS security update released on Jan 3rd had Intel microcode in it. MS is now working with Intel to make a new patch, since that one caused problems. I am not saying Intel won't also release a BIOS update. Only pointing out microcode can be updated with a utility that leaves the BIOS untouched. And this latter option is what AMD has chosen, when they make their microcode available. At least that's what their website says at this point.
Microcode can be pushed to systems at boot time, there are special DLLs for that. But, if they opt for firmware updates through the board manufacturers, obviously not all things can be fixed that way. There might still be mitigations that have to be applied during POST.
@Zepp, AMD don't have microcode, and the AMD Agesa firmware has been really buggy. 1.0.0.6b was the most stable version & anything above that has been crap. Trying to patch already dodgy firmware? I won't be holding my breath for any stable releases...
I have never installed microcode from AMD as my machine has always run perfectly with the original modded BIOS I got from MDL many years ago, so I have no basis for commenting on past code. If it ain't broke, don't fix it. As for variant 2 of Spectre, no they don't have microcode available yet but they will, however as previously stated, it's optional b/c the risk is so minuscule that it hasn't even been exploited in a lab yet. So I will keep an eye on how that develops over time, and also on how the upcoming microcode update works on the GP when it is finally released. At this point the downside of losing performance, even for a stable release, is not justified by the threat where AMD chips are concerned, imo.